🎯API Stability
Long-TermThis API is stable and will remain supported across versions with minimal breaking changes.

Summary

The updateScheduledSearchV3() mutation updates a scheduled search in a LogScale view. Use it to modify the query string, schedule, actions, ownership, or other configuration properties of a scheduled search after creation. To create a new scheduled search, use createScheduledSearchV2() instead.

Syntax

graphql
updateScheduledSearchV3(
      input: UpdateScheduledSearchV3!
   ): ScheduledSearch!

The mutation accepts a single required input argument of type UpdateScheduledSearchV3. The input requires the view name, the scheduled search ID, and the scheduled search name, along with all other configuration fields. The mutation returns a non-null ScheduledSearch object representing the updated scheduled search.

Use the repositories() query to retrieve the scheduled search ID.

Input parameters

The viewName, id, and name fields identify the scheduled search to update. All other required fields replace the current configuration values in full — partial updates are not supported. Optional fields such as description, searchIntervalOffsetSeconds, maxWaitTimeSeconds, backfillLimit, and runAsUserId can be omitted when not applicable to the selected queryTimestampType. The searchIntervalOffsetSeconds and backfillLimit parameters apply only when queryTimestampType is EventTimestamp. The maxWaitTimeSeconds parameter applies only when queryTimestampType is IngestTimestamp. The full parameter reference follows.

Table: UpdateScheduledSearchV3 Input Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionIdsOrNamesStringyes Long-Term List of ids or names for actions to fire on query result. Actions in packages can be referred to as packagescope/packagename:actionname.
backfillLimitInt  Long-Term User-defined limit, which caps the number of missed searches to backfill, such as in the event of a shutdown. Only allowed when queryTimestampType is EventTimestamp where it is mandatory.
descriptionString  Long-Term Description of the scheduled search.
enabledBooleanyes Long-Term Whether the scheduled search is enabled.
idStringyes Long-Term The unique identifier of the scheduled search.
labelsStringyes Long-Term Labels attached to the scheduled search.
maxWaitTimeSecondsLong  Long-Term Maximum number of seconds to wait for ingest delay and query warnings. Only allowed when queryTimestamp is IngestTimestamp where it is mandatory.
nameStringyes Long-Term The name of the scheduled search.
queryOwnershipTypeQueryOwnershipTypeyes Long-Term Ownership of the query run by this scheduled search. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStringStringyes Long-Term LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-Term Timestamp type to use for the query. See QueryTimestampType.
runAsUserIdString  Long-Term The scheduled search will run with the permissions of the user corresponding to this unique identifier if queryOwnershipType is set to User. If queryOwnershipType is set to Organization, while runAsUserId is set, this will result in an error. If not specified, the scheduled search will run with the permissions of the calling user. It requires the ChangeTriggersToRunAsOtherUsers permission to set this field to a different user identifier than that of the calling user.
scheduleStringyes Long-Term Cron pattern describing the schedule on which to execute the query.
searchIntervalOffsetSecondsLong  Long-Term Offset of the search interval in seconds. Only allowed when queryTimestampType is EventTimestamp where it is mandatory.
searchIntervalSecondsLongyes Long-Term The search interval in seconds.
timeZoneStringyes Long-Term Time zone of the schedule. Currently, this field only supports UTC offsets (e.g., 'UTC', 'UTC-01' or 'UTC+12:45').
triggerOnEmptyResultBooleanyes Long-Term Whether the scheduled search should trigger when it finds en empty result (i.e., no events).
viewNameStringyes Long-Term The name of the view of the scheduled search.

Example

Raw
graphql
mutation {
  updateScheduledSearchV3( input:
    { viewName: "humio",
      id: "abc123",
      name: "mySearch",
      queryString: "@host=localhost",
      searchIntervalSeconds: 10,
      schedule: "15 1 * * *",
      timeZone: "UTC+2",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User,
      triggerOnEmptyResult: true
    }
  )
 { id }
}
Mac OS or Linux (curl)
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateScheduledSearchV3( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User,
      triggerOnEmptyResult: true
    }
  )
 { id }
}"
}
EOF
Mac OS or Linux (curl) One-line
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d @- << EOF
{"query" : "mutation {
  updateScheduledSearchV3( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User,
      triggerOnEmptyResult: true
    }
  )
 { id }
}"
}
EOF
Windows Cmd and curl
shell
curl -v -X POST $YOUR_LOGSCALE_URL/graphql ^
    -H "Authorization: Bearer $TOKEN" ^
    -H "Content-Type: application/json" ^
    -d @'{"query" : "mutation { ^
  updateScheduledSearchV3( input: ^
    { viewName: \"humio\", ^
      id: \"abc123\", ^
      name: \"mySearch\", ^
      queryString: \"@host=localhost\", ^
      searchIntervalSeconds: 10, ^
      schedule: \"15 1 * * *\", ^
      timeZone: \"UTC+2\", ^
      enabled: false, ^
      actionIdsOrNames: [], ^
      labels: [], ^
      queryOwnershipType: User, ^
      triggerOnEmptyResult: true ^
    } ^
  ) ^
 { id } ^
}" ^
} '
Windows Powershell and curl
powershell
curl.exe -X POST 
    -H "Authorization: Bearer $TOKEN"
    -H "Content-Type: application/json"
    -d '{"query" : "mutation {
  updateScheduledSearchV3( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User,
      triggerOnEmptyResult: true
    }
  )
 { id }
}"
}'
    "$YOUR_LOGSCALE_URL/graphql"
Perl
perl
#!/usr/bin/perl

use HTTP::Request;
use LWP;

my $TOKEN = "TOKEN";

my $uri = '$YOUR_LOGSCALE_URL/graphql';

my $query = "mutation {
  updateScheduledSearchV3( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User,
      triggerOnEmptyResult: true
    }
  )
 { id }
}";
$query =~ s/\n/ /g;
my $json = sprintf('{"query" : "%s"}',$query);
my $req = HTTP::Request->new("POST", $uri );

$req->header("Authorization" => "Bearer $TOKEN");
$req->header("Content-Type" => "application/json");

$req->content( $json );

my $lwp = LWP::UserAgent->new;

my $result = $lwp->request( $req );

print $result->{"_content"},"\n";
Python
python
#! /usr/local/bin/python3

import requests

url = '$YOUR_LOGSCALE_URL/graphql'
mydata = r'''{"query" : "mutation {
  updateScheduledSearchV3( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User,
      triggerOnEmptyResult: true
    }
  )
 { id }
}"
}'''

resp = requests.post(url,
                     data = mydata,
                     headers = {
   "Authorization" : "Bearer $TOKEN",
   "Content-Type" : "application/json"
}
)

print(resp.text)
Node.js
javascript
const https = require('https');

const data = JSON.stringify(
    {"query" : "mutation {
  updateScheduledSearchV3( input:
    { viewName: \"humio\",
      id: \"abc123\",
      name: \"mySearch\",
      queryString: \"@host=localhost\",
      searchIntervalSeconds: 10,
      schedule: \"15 1 * * *\",
      timeZone: \"UTC+2\",
      enabled: false,
      actionIdsOrNames: [],
      labels: [],
      queryOwnershipType: User,
      triggerOnEmptyResult: true
    }
  )
 { id }
}"
}
);


const options = {
  hostname: '$YOUR_LOGSCALE_URL',
  path: 'graphql',
  port: 443,
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'Content-Length': data.length,
    Authorization: 'BEARER ' + process.env.TOKEN,
    'User-Agent': 'Node',
  },
};

const req = https.request(options, (res) => {
  let data = '';
  console.log(`statusCode: ${res.statusCode}`);

  res.on('data', (d) => {
    data += d;
  });
  res.on('end', () => {
    console.log(JSON.parse(data).data);
  });
});

req.on('error', (error) => {
  console.error(error);
});

req.write(data);
req.end();
Example Responses
Success (HTTP Response Code 200 OK)
json
{
  "data": {
    "updateScheduledSearchV3": {
      "id": "abc123"
    }
  }
}

Returned values

The mutation returns a ScheduledSearch object representing the updated scheduled search. The returned object includes the query string, schedule configuration, associated actions, ownership details, enabled state, and execution results such as errors or warnings from the most recent run. The full field reference follows.

Table: ScheduledSearch Datatype

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsStringyes Long-Term List of unique identifiers for actions to fire on query result.
actionsV2Actionyes Long-Term List of actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term The allowed asset actions. See AssetAction .
backfillLimitV2Int  Long-Term User-defined limit, which caps the number of missed searches to backfill when queryTimestampType is EventTimestamp.
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the scheduled search. See AssetCommitMetadata.
descriptionString  Long-Term A description of the scheduled search.
enabledBooleanyes Long-Term Whether the scheduled search is enabled.
executionTimesToRerunLongyes Long-Term Execution times of the scheduled search runs to rerun as Unix timestamp in milliseconds.
idStringyes Long-Term The unique identifier of the scheduled search.
labelsStringyes Long-Term The labels added to the scheduled search.
lastErrorString  Long-Term The last error encountered while running the search.
lastExecutedLong  Deprecateddeprecated in 1.282Unix timestamp for end of search interval for last query execution. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastExecution parameter.
lastTriggeredLong  Deprecateddeprecated in 1.282Unix timestamp for end of search interval for last query execution that triggered. However, this parameter has been deprecated because the name is confusing. It will be removed at the earliest in version 1.27. Use instead the timeOfLastTrigger parameter.
lastWarningsStringyes Long-Term The Last warnings encountered while running the scheduled search.
maxWaitTimeSecondsLong  Long-Term The maximum wait time in seconds when queryTimestampType is IngestTimestamp.
modifiedInfoModifiedInfoyes Long-Term User or token used to modify the asset. See ModifiedInfo.
nameStringyes Long-Term The name of the scheduled search.
packagePackageInstallation  Long-Term The related package. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The unique identifier for the related package. VersionedPackageSpecifier is a scalar.
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this scheduled search. See QueryOwnership.
queryStringStringyes Long-Term The LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-Term The timestamp type to use for the query. Running on @ingesttimestamp is only available with feature flag ScheduledSearchIngestTimestamp. See QueryTimestampType .
resourceStringyes Short-Term The resource identifier for the scheduled search.
runAsUserUser  Long-Term The unique identifier of the user as which the scheduled search is running. See User.
scheduleStringyes Long-Term The cron pattern describing the schedule to execute the query on.
searchIntervalOffsetSecondsLong  Long-Term The search interval offset in seconds when queryTimestampType is EventTimestamp.
searchIntervalSecondsLongyes Long-Term The search interval in seconds.
timeOfLastExecutionLong  Long-Term Unix timestamp for when the scheduled search was last executed.
timeOfLastTriggerLong  Long-Term Unix timestamp for when the scheduled search was last triggered.
timeOfNextPlannedExecutionLong  Long-Term The UNIX timestamp for next planned search.
timeZoneStringyes Long-Term Time zone of the schedule. Currently, this field only supports UTC offsets like 'UTC', 'UTC-01' or 'UTC+12:45'.
triggerOnEmptyResultBooleanyes Long-Term Flag indicating whether the scheduled search should trigger when it finds an empty result (i.e., no events).
yamlTemplateYAMLyes Long-Term A template that can be used to recreate the scheduled search. YAML is a scalar.